Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
I am helping to edit a guide to using KeePassXC, and found that the author had inserted a warning: "If your machine is compromised, an attacker can intercept the communication between your browser plug-in and KeePassXC." I believe that was motivated by the warning text here. As noted in pfn/keepasshttp#258 and keepassxreboot/keepassxc#147, communicating via HTTP with localhost is safe, since an attacker who can intercept localhost communications can just read your passwords directly. Since localhost-only is now the default mode in KeePassHTTP, I think this note just creates confusion and unnecessary fear among users.
- Loading branch information